CVE-2026-55638: 9Router Authentication Bypass Vulnerability

CVE-2026-55638 Overview

CVE-2026-55638 is a missing authorization vulnerability [CWE-862] in 9Router, an AI router and token saver application. Versions prior to 0.5.2 protect the /v1, /v1beta, /api/v1, and /api/v1beta routes in src/dashboardGuard.js but omit the /codex path. The next.config.mjs file rewrites /codex/* requests to /api/v1/responses, bypassing the API-key gate entirely. A remote unauthenticated attacker can send requests to /codex/* to trigger upstream provider calls using operator-stored large language model (LLM) credentials. The issue is fixed in version 0.5.2.

Critical Impact
Remote unauthenticated attackers can abuse operator-stored LLM provider credentials to make upstream API calls, resulting in token exhaustion, financial cost, and service disruption.

Affected Products

9Router versions prior to 0.5.2
Deployments exposing 9Router network interfaces to untrusted networks
Instances relying solely on dashboardGuard.js for API-key enforcement

Discovery Timeline

2026-07-10 - CVE-2026-55638 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55638

Vulnerability Analysis

The vulnerability stems from an incomplete route allowlist in the request guard. The src/dashboardGuard.js module enforces API-key authentication only on specific path prefixes: /v1, /v1beta, /api/v1, and /api/v1beta. However, next.config.mjs defines a rewrite rule that transparently maps /codex/* to /api/v1/responses after guard evaluation. Because the guard inspects the incoming request path before the rewrite occurs, requests targeting /codex/* are never subjected to the API-key check.

An attacker can invoke the responses endpoint anonymously, causing the server to forward prompts to upstream providers using credentials configured by the operator. This produces direct financial impact through token consumption and can exhaust rate limits, degrading availability for legitimate users.

Root Cause

The root cause is a missing authorization check on the /codex route prefix [CWE-862]. The route allowlist in the dashboard guard was not synchronized with the rewrite table in next.config.mjs, creating a gap between routing configuration and access-control policy.

Attack Vector

Exploitation requires only network access to the 9Router instance. No authentication, credentials, or user interaction are needed. An attacker sends an HTTP request to /codex/<anything> with a crafted body that mirrors the /api/v1/responses schema, and the server proxies the request upstream using operator credentials.

javascript

// Security patch context in cli/cli.js - network exposure hardening
const DEFAULT_PORT = 20128;
const DEFAULT_HOST = "0.0.0.0";

// First non-internal IPv4 — the address remote peers actually reach when bound to 0.0.0.0.
function getLanIp() {
  for (const ifaces of Object.values(os.networkInterfaces())) {
    for (const i of ifaces || []) {
      if (i.family === "IPv4" && !i.internal) return i.address;
    }
  }
  return null;
}

// Local URL stays "localhost"; warn separately when bound to all interfaces (network-exposed).
function getDisplayHost() {
  return host === DEFAULT_HOST ? "localhost" : host;
}

Source: GitHub Commit b282f055

Detection Methods for CVE-2026-55638

Indicators of Compromise

Unexpected HTTP requests to /codex/* paths in web server or reverse proxy access logs.
Anomalous spikes in upstream LLM provider token consumption or billing anomalies not correlated to legitimate operator activity.
Outbound API calls to LLM providers originating from the 9Router host during periods of no authenticated user sessions.

Detection Strategies

Review access logs for requests matching the pattern GET|POST /codex/ from unauthenticated or unexpected source IPs.
Correlate 9Router upstream provider usage metrics with authenticated dashboard sessions to identify unauthorized invocations.
Deploy web application firewall (WAF) rules that alert on /codex/* traffic when the deployed 9Router version is below 0.5.2.

Monitoring Recommendations

Enable verbose access logging on 9Router and any fronting reverse proxy to capture full request paths and source IPs.
Set billing and usage alerts with LLM providers (OpenAI, Anthropic, others) to flag consumption anomalies.
Monitor outbound network connections from the 9Router host for unexpected volume to provider API endpoints.

How to Mitigate CVE-2026-55638

Immediate Actions Required

Upgrade 9Router to version 0.5.2 or later without delay.
Rotate all LLM provider API keys configured in 9Router if the instance was exposed to untrusted networks prior to patching.
Restrict network exposure of the 9Router listener by binding to localhost or placing the service behind an authenticated reverse proxy.

Patch Information

The fix is available in 9Router version 0.5.2. See the GitHub Release v0.5.2, the GitHub Security Advisory GHSA-8gmq-j984-vp4r, and the remediation commit for full technical details.

Workarounds

Block or reject requests to /codex/* at an upstream reverse proxy or WAF until the patch is applied.
Bind the 9Router process to 127.0.0.1 rather than 0.0.0.0 to eliminate remote reachability.
Enforce network-level authentication (mutual TLS, VPN, or IP allowlisting) in front of the 9Router service.

bash

# Example nginx rule to block the unprotected /codex route pre-patch
location ~ ^/codex/ {
    return 403;
}

# Alternatively, bind 9router to loopback only
# Start 9router with HOST=127.0.0.1 instead of 0.0.0.0
HOST=127.0.0.1 PORT=20128 npx 9router